CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields
Authenticated non-admin users can view hidden admin-only project custom field comments via the inplace-edit dialog, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55095?
CVE-2026-55095 is a medium-severity vulnerability in opf openproject, published on 20 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-55095?
How do I fix CVE-2026-55095?
No fix has been published for CVE-2026-55095 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-55095 being exploited?
There is no known exploitation of CVE-2026-55095 in the wild and no public exploit code.
Sources
Also known as GHSA-63fg-pgqj-3qf8.